Extracted

• • Target
    30b905425268c8f8de4763e09d7b827469a4970955cc1cdf4890b966c9f94131
  • Size 45KB
  • SHA256 30b905425268c8f8de4763e09d7b827469a4970955cc1cdf4890b966c9f94131
  • MD5 69349ac53f194feaa08a0478da61e64b
  • SHA1 0b59ffaf718d49c362f46aa517f387185ae97b28
  • SHA512 a9f0bd5a7bd38dbca5d115da8dbd2046cee6af875fd1fd84378e4e4d1b8329cbc5d0a28d434854ec46733d338c75a8ff41ae433f89e5aff9fccaf49d6dfd493a
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlpsuXueMedX8vnPIMXzjb/gX3PdiuXd+7SBDZMx:wuDWZTpMZSB2vuzPdXiAMX3bIXfdLAs8
  • TLSH
    T15F233A003BE9822BF1BF4F78A9F26145867AF1732503D94E1CC452975713BC68A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2